registry / AI-agent control-surface risk / open-walnut / 0.6.16

open-walnut@0.6.16

Personal AI powered by Claude — task management, Claude Code sessions, memory system, and web UI

AI Security Review

scanned 17h ago · by lpm-firewall-ai

The package’s postinstall hook automatically rewrites a consumer-installed AI agent CLI to remove its safety reminder. This is concrete install-time control-surface tampering and warrants a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm, which runs its postinstall hook.

Impact

The SDK no longer receives the removed safety reminder, changing how its agent handles malware-related requests.

Mechanism

The hook reads the SDK patch, matches its target version, replaces the old CLI text with the patched text, and writes the CLI file.

Policy narrative

During npm installation, open-walnut patches the installed Claude Agent SDK CLI. The patch removes a safety reminder that directs the agent to analyze malware while refusing to improve it. This is an unconsented lifecycle change to an AI agent’s control prompt.

AI rationale

The package’s postinstall hook automatically rewrites a consumer-installed AI agent CLI to remove its safety reminder. This is concrete install-time control-surface tampering and warrants a block.

Evidence

package.jsonscripts/postinstall.mjspatches/@anthropic-ai+claude-agent-sdk+0.2.50.patchnode_modules/@anthropic-ai/claude-agent-sdk/cli.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs scripts/postinstall.mjs.
The package depends on @anthropic-ai/claude-agent-sdk@0.2.50, whose installed CLI the hook targets.
The hook replaces a matching SDK CLI string and writes the modified file during installation.
The shipped patch removes the SDK’s safety reminder about malware analysis and code improvement.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 147 file(s), 7.06 MB of source, external domains: 127.0.0.1, docs.oasis-open.org, github.com, graph.microsoft.com, help.yahoo.com, json-schema.org, login.microsoftonline.com, myaccount.google.com, npms.io, openoffice.org, purl.oclc.org, purl.org, raw.githubusercontent.com, react.dev, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, sheetjs.openxmlformats.org, stuk.github.io, support.apple.com, support.microsoft.com, to-do.microsoft.com, tracker.example.com, walnut.invalid, www.apple.com, www.fastmail.help, www.w3.org

Source & flagged code

26 flagged

package.jsonView file

Lines 44-84json

44 "esbuild": true,

45 "onnxruntime-node": true,

46 "protobufjs": true,

47 "screencapturekit-audio-capture": true,

48 "sharp": true

49 },

50 "files": [

51 "bin",

52 "dist",

53 "!dist/daemon-binaries/daemon-linux-*",

54 "!dist/daemon-binaries/daemon-darwin-*",

55 "dist/daemon-binaries/dtach-*",

56 "!dist/**/*.map",

57 "!dist/**/*.gz",

58 "patches",

59 "scripts/postinstall.mjs",

60 "README.md",

61 "LICENSE"

62 ],

63 "scripts": {

64 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 "prepublishOnly": "WALNUT_REQUIRE_BUN=1 npm run build && cd web && npx vite build && cd .. && node scripts/check-publish.mjs",

66 "prestart": "node scripts/check-node.mjs && node scripts/check-native-toolchain.mjs",

67 "start": "npm run web:build && node dist/cli.js web --port 3456",

68 "build:plugins": "npm run build -w @open-walnut/plugin-api && npm run build -w @open-walnut/plugin-cli",

69 "build": "npm run build:plugins && bash scripts/build-daemon.sh && tsup && rm -rf dist/data && cp -r src/data dist/ && for d in src/integrations/*/manifest.json; do t=\"dist/integrations/$(basename $(dirname $d))\"; mkdir -p \"$t\"; cp \"$d\" \"$t/\"; i=\"$(dirname $d)/icon.svg\"; rm -f \"$t/icon.svg\"; if [ -f \"$i\" ]; then cp \"

70 "docs:check": "node scripts/generate-ops-docs.mjs --check --repo-only && node scripts/check-plugin-doc-snippets.mjs",

71 "test:plugin-packages": "npm run build:plugins && vitest run --config vitest.focus.config.ts tests/core/plugin-package-metadata.test.ts tests/core/plugin-cli-dev.test.ts tests/core/plugin-cli-scaffold.test.ts tests/core/plugin-publish-check.test.ts && node scripts/check-plugin-packages.mjs",

72 "dev": "tsup --watch",

73 "release": "node scripts/release.mjs",

74 "test": "node scripts/test-parallel.mjs",

75 "test:quick": "npm run docs:check && vitest run --config vitest.quick.config.ts",

76 "search:eval": "tsx scripts/search-eval.mjs",

77 "search:robustness": "tsx scripts/search-robustness-eval.mjs",

78 "test:slow": "vitest run --config vitest.slow.config.ts",

79 "test:focus": "vitest run --config vitest.focus.config.ts",

80 "test:frontend:ci": "node scripts/test-frontend.mjs",

81 "test:changed": "node scripts/test-changed.mjs",

82 "test:baseline": "node scripts/test-baseline.mjs check",

83 "test:baseline:record": "node scripts/test-baseline.mjs record",

84 "test:pre-commit": "npm run docs:check && node scripts/test-changed.mjs --tiers",

dist/plugin-store/walnut-rhythm/dist/server.mjsView file

Lines 1-28javascript

1import{createRequire as __cr}from"node:module";const require=__cr(import.meta.url);

3// plugin-store/walnut-rhythm/src/server.ts

4import fsp3 from "node:fs/promises"

dist/workers/git-compaction-worker.jsView file

Lines 1269-1309javascript

1269

1270// src/utils/json-conflict-recovery.ts

1271import fsp2 from "fs/promises";

1272import path4 from "path";

1273import os2 from "os";

1274import

dist/web/static/assets/jszip.min-uwLYs-GL.jsView file

Lines 1-13javascript

1import{D as bt,F as It}from"./index-CHgkj5Sr.js";function vt(yt){throw new Error('Could not dynamically require "'+yt+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.'

bin/open-walnut.jsView file

Lines 43-68javascript

43 || (!sub && (args.includes('--version') || args.includes('-V'))));

44// The import is the whole program, so its failure must be LOUD. Unhandled, a

45// bundle that is momentarily empty (dist rewritten by a concurrent build) made

46// the CLI exit 0 having printed nothing at all — a caller in a loop reads that as

47// "the command answered, with nothing", which is the worst possible answer.

dist/daemon-binaries/daemon-service-cli.cjsView file

Lines 1-21javascript

1var ei=Object.create;var{getPrototypeOf:ti,defineProperty:Be,getOwnPropertyNames:cr,getOwnPropertyDescriptor:ri}=Object,Dt=Object.prototype.hasOwnProperty;function lr(e){

dist/daemon-binaries/dtach-linux-x64View file

•path = dist/daemon-binaries/dtach-linux-x64 kind = native_binary sizeBytes = 731144 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/daemon-binaries/dtach-linux-x64View on unpkg

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 13411719 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 13652264 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/cli-fast.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-fast.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.15 matchedPath = dist/cli-fast.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High